In a significant escalation of the global cyber threat landscape, the notorious threat group ShinyHunters appears to be transitioning from data theft to full-scale ransomware operations. Cybersecurity researchers have identified an early build of a new Ransomware-as-a-Service (RaaS) platform dubbed “ShinySp1d3r,” marking the first instance in which the group has eschewed external encryption tools in […]
Three West London councils are struggling with significant disruption to IT systems and phone lines after a cyberattack on a shared services provider, which officials are publicly describing only as an “IT incident”.
The Royal Borough of Kensington and Chelsea (RBKC), Westminster City Council (WCC), and Hammersmith and Fulham Council have all been affected.
According to statements from RBKC, the issue was first acknowledged on Tuesday evening, November 25.
When the council confirmed it was “responding to a cyber security issue” and working with its partners to investigate and restore services.
Cyberattack Disrupts IT and Phone Services
According to cyberplace, the attack disrupted key back-office systems provided through their shared services setup, affecting online services and making it harder for residents to reach the councils.
Local reports say some phone lines and customer services have been going down or running slowly, forcing residents to use limited options or visit council offices in person for urgent needs.
Although the councils haven’t confirmed it as ransomware, experts say the signs point to a ransomware attack affecting a shared IT provider used by several London authorities.
Commentators have noted that describing it as an “IT incident” is a common tactic used early in serious cyber events while investigations and containment are still underway.
The councils say they are working with external cybersecurity specialists and national agencies to understand the scope of the breach, protect data, and bring systems back online safely.
Critical services, such as social care and emergency support, are being prioritised, with manual workarounds in place where digital systems are unavailable.
Residents are being asked to check council websites and official social media for updates, expect delays on phone lines, and use online forms or email when possible.
The full extent of the impact, including any potential data compromise, has not yet been confirmed as the investigation continues.
The Shai Hulud 2.0 worm, first detected on November 24, 2025, has compromised nearly 1,200 organizations, including major banks, government bodies, and Fortune 500 technology firms.
While initial reports described it as a simple npm supply chain attack that flooded GitHub with spam repositories, new analysis reveals a far more sophisticated operation.
Entro Security researchers observed that the malware did not just create noise; it successfully exfiltrated sensitive runtime memory and credentials from deep within corporate CI/CD pipelines.
Early analysis focused on the thousands of attacker-controlled GitHub repositories generated by the worm. However, researchers at Entro Security have confirmed that these repositories were merely the “collection layer” for a much larger heist.
The true damage occurred inside the victim environments, developer endpoints, cloud build servers, and self-hosted GitHub runners, where the malware executed payload scripts during the “preinstall” phase of compromised npm packages.
Instead of just scraping static files, Shai Hulud 2.0 captured full runtime environments. Entro Security analysis found that the generated artifacts, like environment.json, contained double-base64-encoded memory snapshots.
Shai Hulud 2.0 Double-encoded memory Snapshots
These snapshots allowed attackers to reconstruct the exact state of compromised machines, granting them access to in-memory secrets that never appeared in code repositories.
The scale of the compromise is staggering. Entro researchers identified 1,195 distinct organizations by analyzing email domains, internal hostnames, and tenant identifiers found in the exfiltrated data.
organizations Impacted (Credits: Entro)
Technology and SaaS companies suffered the most from the attack, representing over half of the identified victims.
Industry Sector
Number of Compromised Orgs
Technology / SaaS
647
Financial Services & Banking
53
Healthcare
38
Insurance
26
Media
21
Telecom
20
Logistics
15
Two specific examples highlight the severity of the breach. The first involved one of the world’s largest semiconductor companies, where a self-hosted GitHub Actions runner was compromised.
The decoded memory dump exposed active GitHub Personal Access Tokens and internal hostnames, proving the attackers had valid entry points into the company’s internal infrastructure.
The second victim was a Tier-1 digital asset custody provider. In this case, the malware struck a GitLab CI pipeline. The exfiltrated data included live AWS secret keys, blockchain production tokens, and Slack API keys.
Critically, scans conducted on November 27, three days after the initial disclosure, revealed that some of these high-value credentials, including Google Cloud Service Account keys, were still valid and had not been revoked.
The GitHub repositories associated with Shai Hulud 2.0 are being removed, but the stolen credentials remain in the attacker’s hands. The campaign demonstrates that any environment where code is executed, whether a local laptop or a cloud-based CI runner, is a potential target for memory scraping.
With valid secrets circulating days after the attack, organizations are urged to rotate all non-human identities and treat their runtime environments as fully compromised.
Cybersecurity firm GreyNoise has launched a new, free utility designed to answer a question most internet users never think to ask: Is my home router secretly attacking other computers? The newly released GreyNoise IP Check is a simple, web-based tool that allows anyone to instantly verify whether their internet connection is being used by a […]
A sophisticated, complex new cyber offensive has emerged from the “Scattered Lapsus$ Hunters,” a threat collective that has aggressively shifted toward exploiting supply-chain vulnerabilities.
This latest campaign targets Zendesk, a critical customer support platform, effectively turning a trusted business tool into a launchpad for corporate spying.
The attackers have successfully registered over 40 typosquatted domains, including deceptive examples like znedesk[.]com and vpn-zendesk[.]com.
These sites are meticulously designed to mimic legitimate login environments, hosting fraudulent Single Sign-On (SSO) portals that capture credentials from unsuspecting users.
The campaign’s infrastructure reveals a coordinated effort to bypass standard detection protocols. The domains were consistently registered through NiceNic and use Cloudflare-masked nameservers to hide their true hosting origins.
By using these hiding techniques, the actors ensure their phishing pages remain active long enough to harvest significant volumes of high-privilege credentials before defenders can react.
This demonstrates a clear, strategic evolution in their capabilities, allowing them to maintain operational secrecy while targeting widespread platforms used by global enterprises.
The impact of this targeted approach extends far beyond simple credential theft. Reliaquest security analysts identified the malware and noted that the campaign shares distinct domain registry characteristics with the group’s previous attacks on Salesforce in August 2025.
Once attackers bypass the initial authentication layer, they establish a persistent foothold that facilitates lateral movement across the corporate network.
This access allows them to steal highly sensitive customer data, including billing information and government IDs, mirroring the massive data theft seen in their September 2025 breach of Discord.
Weaponizing Support Tickets
The group’s most dangerous tactic involves the direct weaponization of legitimate support tickets to bypass traditional perimeter defenses.
Instead of relying solely on external phishing emails, they submit fraudulent tickets directly into an organization’s Zendesk portal.
These tickets typically masquerade as urgent system administration requests or password reset inquiries, creating a fabricated sense of urgency that compels support agents to act without verification.
Embedded within these tickets are links to the typosquatted domains or malicious payloads designed to compromise the endpoint.
When a help-desk employee interacts with the ticket, they accidentally trigger the download of Remote Access Trojans (RATs).
This grants the attackers persistent remote control, allowing them to execute commands and monitor activity.
Scattered Lapsus$ Hunters Telegram post (Source – Reliaquest)
The group has brazenly boasted about these complex operations, specifically warning incident response teams to watch their logs closely as they prepare to collect vital customer databases through the upcoming 2026 holiday season.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
Comcast has agreed to a $1.5 million settlement with the Federal Communications Commission (FCC) following a data breach at a third-party vendor that exposed the personal information of hundreds of thousands of its customers. The breach has raised concerns about the security of customer data when handled by external companies. The incident originated with Financial […]
Microsoft has announced a significant security change to the Microsoft Entra ID sign-in experience that will block external scripts from running during user logins. The update is designed to stop unauthorized or injected code from executing on the login page. It is part of Microsoft’s broader Secure Future Initiative to harden its cloud identity platform. […]
The Royal Borough of Kensington and Chelsea (RBKC), Westminster City Council, and Hammersmith and Fulham Council confirmed they were targeted in the incident that began on Monday, November 24. The attack has forced officials to shut down systems as a precautionary measure while they work to restore services and investigate potential data compromise. The first […]
A new open-source tool called KawaiiGPT has surfaced on GitHub, positioning itself as a “cute” but unrestricted version of artificial intelligence. Developed by a user known as MrSanZz (along with contributors Shoukaku07 and FlamabyX5), the project is attracting attention for offering a free alternative to paid “jailbroken” AI models. It describes itself as a “WormGPT kawaii ver,” […]
Black Friday is supposed to be chaotic, sure, but not this chaotic. Amid genuine doorbusters and flash sales, a large-scale, highly polished scam campaign is hijacking web traffic and pushing shoppers to fake “survey reward” pages impersonating dozens of major brands all to steal payment card details and personal data. Security research into malvertising ahead […]
.webp)